The Biggest Cyber-Security Threats Are Inside Your Company
When Security Breaches Make Headlines, They Tend To Be About Nefarious Actors In Another Country Or The Catastrophic Failure Of Technology. These Kinds Of Stories Are Exciting To Read And Easier For The Hacked Company To Admit To. But The Reality Is That No Matter The Size Or The Scope Of A Breach, Usually It’s Caused By An Action, Or Failure, Of Someone Inside The Company.
The Role That Insiders Play In The Vulnerability Of All Sizes Of Corporations Is Massive And Growing. Health Care, Manufacturing, And Financial Services Are The Top Three Industries Under Attack, Due To Their Personal Data, Intellectual Property And Physical Inventory, And Massive Financial Assets, Respectively. However, While Industries And Sectors Differ Substantially In The Value And Volume Of Their Assets And In The Technology Infrastructures They Have To Manage And Defend, What All Businesses Have In Common Is People All Of Whom Have The Potential To Be An Insider Threat.
Before Addressing The Threat, It’s Helpful To Understand The Primary Types Of Insider Risks:
We’re Only Human, And At Exactly The Wrong Time. Human Error Is A Major Factor In Breaches, And Trusted But Unwitting Insiders Are To Blame. From Misaddressed Emails To Stolen Devices To Confidential Data Sent To Insecure Home Systems, Mistakes Can Be Very Costly. The Riskiest Of These Are Well-meaning IT Admins, Whose Complete Access To Company Infrastructure Can Turn A Small Mistake Into A Catastrophe.
A Few People Leak The Passwords. With These Trusted But Witting Insiders, It’s The Thought That Counts. Malicious Employees Whose Intent Is To Steal Or Damage Are A Very Real Risk. Some Steal Competitive Information, Some Sell Data Or Intelligence, And Some Just Have A Vendetta Against The Organization.
A Wolf In The Clothing Of Isaac From Accounting. Cyber Criminals Are Experts At Hijacking Identities. Some Accomplish This By Compromising An Employee System Through Malware Or Phishing Attacks; Some Leverage Stolen Credentials, Especially By Gleaning Data From Social Networks. In Many Cases Attackers Can Increase A Hacked User’s Access Within A System, Leading Them To Even More Sensitive Information.
The Most Dangerous Aspect Of Insider Threats Is The Fact That The Access And Activities Are Coming From Trusted Systems, And Thus Will Fly Below The Radar Of Many Detection Technologies. Particularly In The Latter Two Categories, Malicious Actors Can Erase Evidence Of Their Activities And Presence To Further Complicate Forensic Investigations.
Based On The Success Of These Types Of Attacks, They Seem To Represent A Perfect Crime. And In Some Organizations The Challenge Of Identifying These Rogue Elements Has Resulted In Attempts At “zero Trust” Environments. But Security Teams Have Another Formidable Adversary: Reality. While Restrictive Security Policies May Seem To Be A Valid Strategy, They Impede Productivity, Hamper Innovation, And Frustrate Users.
Fortunately, Analytics And The Rise Of Artificial Intelligence Make Spotting Potential Insider Threats Easier And Less Intrusive. However, Even With Advances In Technology, Managers Need To Be Aware Of What To Look For And How To Focus Their Security Efforts To Get The Greatest Returns On Protection:
- Focus On The Right Assets. Bad Guys Want What You Value Most, What We Call Your Businesses’ “crown Jewels.” Identify The Most-valuable Systems And Data, And Then Give Them The Strongest Defenses And The Most Frequent Monitoring.
- Apply Deep Analytics. Humans Are Creatures Of Habits: They Come To Work At The Same Time And Do Familiar Tasks. The Same Can Be Said For How They Use And Interact With Technology. Deep Analytics And AI Can Uncover Deviations In Behavior At The Level Of Individual Employees, Which Can Make It Much Easier To Spot Indications That Systems Have Been Compromised. We Recently Helped A Customer Collect And Analyze Terabytes Of Such Data, And Within 15 Minutes They Saw Violations Of Policy That They Didn’t Know Existed.
- Know Your People. Understanding The Users Who Hold The Potential For Greatest Damage Is Critical. Addressing The Security Risks That These People Represent, And The Critical Assets They Access, Should Be A Priority. In Particular, Monitor IT Admins, Top Executives, Key Vendors, And At-risk Employees With Greater Vigilance.
- Don’t Forget The Basics. In Security We Love The Newest Tools. But Getting The Basics Done Well Can Make The Biggest Impact On Insiders: Applying Software Patches Automatically Closes That Open Window Before A Hacker Can Use It To Access Your Network. Enforcing Strong Standards For User Identities And Passwords Means Stealing Credentials Is That Much Harder. Collecting All The Data And Forensics You Can On Every Device That Touches Your Network Makes Sure You’re The First To Know If You’ve Been Hacked, Not The Last. But Forget Technology Altogether User Awareness Programs Are The Key To Educating Insiders. Train Your People, Test Them, And Then Try To Trick Them With Fake Exercises. These Basics Make A Disproportionate Impact But They Do Require Work And Perseverance.
So When You Read The Next Salacious Headline About Some Breach By An External Hacker, Remember That These Attacks Account For Less Than Half Of The Breaches Out There. And Remember That The Hacker Probably Used The Identity Of An Unsuspecting Employee To Pull It Off. Take Action To Make Sure Your Organization Isn’t The Next One In These Headlines.
The Role That Insiders Play In The Vulnerability Of All Sizes Of Corporations Is Massive And Growing. Health Care, Manufacturing, And Financial Services Are The Top Three Industries Under Attack, Due To Their Personal Data, Intellectual Property And Physical Inventory, And Massive Financial Assets, Respectively. However, While Industries And Sectors Differ Substantially In The Value And Volume Of Their Assets And In The Technology Infrastructures They Have To Manage And Defend, What All Businesses Have In Common Is People All Of Whom Have The Potential To Be An Insider Threat.
Before Addressing The Threat, It’s Helpful To Understand The Primary Types Of Insider Risks:
We’re Only Human, And At Exactly The Wrong Time. Human Error Is A Major Factor In Breaches, And Trusted But Unwitting Insiders Are To Blame. From Misaddressed Emails To Stolen Devices To Confidential Data Sent To Insecure Home Systems, Mistakes Can Be Very Costly. The Riskiest Of These Are Well-meaning IT Admins, Whose Complete Access To Company Infrastructure Can Turn A Small Mistake Into A Catastrophe.
A Few People Leak The Passwords. With These Trusted But Witting Insiders, It’s The Thought That Counts. Malicious Employees Whose Intent Is To Steal Or Damage Are A Very Real Risk. Some Steal Competitive Information, Some Sell Data Or Intelligence, And Some Just Have A Vendetta Against The Organization.
A Wolf In The Clothing Of Isaac From Accounting. Cyber Criminals Are Experts At Hijacking Identities. Some Accomplish This By Compromising An Employee System Through Malware Or Phishing Attacks; Some Leverage Stolen Credentials, Especially By Gleaning Data From Social Networks. In Many Cases Attackers Can Increase A Hacked User’s Access Within A System, Leading Them To Even More Sensitive Information.
The Most Dangerous Aspect Of Insider Threats Is The Fact That The Access And Activities Are Coming From Trusted Systems, And Thus Will Fly Below The Radar Of Many Detection Technologies. Particularly In The Latter Two Categories, Malicious Actors Can Erase Evidence Of Their Activities And Presence To Further Complicate Forensic Investigations.
Based On The Success Of These Types Of Attacks, They Seem To Represent A Perfect Crime. And In Some Organizations The Challenge Of Identifying These Rogue Elements Has Resulted In Attempts At “zero Trust” Environments. But Security Teams Have Another Formidable Adversary: Reality. While Restrictive Security Policies May Seem To Be A Valid Strategy, They Impede Productivity, Hamper Innovation, And Frustrate Users.
Fortunately, Analytics And The Rise Of Artificial Intelligence Make Spotting Potential Insider Threats Easier And Less Intrusive. However, Even With Advances In Technology, Managers Need To Be Aware Of What To Look For And How To Focus Their Security Efforts To Get The Greatest Returns On Protection:
- Focus On The Right Assets. Bad Guys Want What You Value Most, What We Call Your Businesses’ “crown Jewels.” Identify The Most-valuable Systems And Data, And Then Give Them The Strongest Defenses And The Most Frequent Monitoring.
- Apply Deep Analytics. Humans Are Creatures Of Habits: They Come To Work At The Same Time And Do Familiar Tasks. The Same Can Be Said For How They Use And Interact With Technology. Deep Analytics And AI Can Uncover Deviations In Behavior At The Level Of Individual Employees, Which Can Make It Much Easier To Spot Indications That Systems Have Been Compromised. We Recently Helped A Customer Collect And Analyze Terabytes Of Such Data, And Within 15 Minutes They Saw Violations Of Policy That They Didn’t Know Existed.
- Know Your People. Understanding The Users Who Hold The Potential For Greatest Damage Is Critical. Addressing The Security Risks That These People Represent, And The Critical Assets They Access, Should Be A Priority. In Particular, Monitor IT Admins, Top Executives, Key Vendors, And At-risk Employees With Greater Vigilance.
- Don’t Forget The Basics. In Security We Love The Newest Tools. But Getting The Basics Done Well Can Make The Biggest Impact On Insiders: Applying Software Patches Automatically Closes That Open Window Before A Hacker Can Use It To Access Your Network. Enforcing Strong Standards For User Identities And Passwords Means Stealing Credentials Is That Much Harder. Collecting All The Data And Forensics You Can On Every Device That Touches Your Network Makes Sure You’re The First To Know If You’ve Been Hacked, Not The Last. But Forget Technology Altogether User Awareness Programs Are The Key To Educating Insiders. Train Your People, Test Them, And Then Try To Trick Them With Fake Exercises. These Basics Make A Disproportionate Impact But They Do Require Work And Perseverance.
So When You Read The Next Salacious Headline About Some Breach By An External Hacker, Remember That These Attacks Account For Less Than Half Of The Breaches Out There. And Remember That The Hacker Probably Used The Identity Of An Unsuspecting Employee To Pull It Off. Take Action To Make Sure Your Organization Isn’t The Next One In These Headlines.
Comments
Post a Comment